{"record":{"id":"fa58276097e80c48","repo":"nsqio/nsq","slug":"failed-to-appendcertsfrompem-s","errorCode":null,"errorMessage":"failed to AppendCertsFromPEM %s","messagePattern":"failed to AppendCertsFromPEM (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nsqadmin/nsqadmin.go","lineNumber":79,"sourceCode":"\t\tInsecureSkipVerify: opts.HTTPClientTLSInsecureSkipVerify,\n\t}\n\tif opts.HTTPClientTLSCert != \"\" && opts.HTTPClientTLSKey != \"\" {\n\t\tcert, err := tls.LoadX509KeyPair(opts.HTTPClientTLSCert, opts.HTTPClientTLSKey)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to LoadX509KeyPair %s, %s - %s\",\n\t\t\t\topts.HTTPClientTLSCert, opts.HTTPClientTLSKey, err)\n\t\t}\n\t\tn.httpClientTLSConfig.Certificates = []tls.Certificate{cert}\n\t}\n\tif opts.HTTPClientTLSRootCAFile != \"\" {\n\t\ttlsCertPool := x509.NewCertPool()\n\t\tcaCertFile, err := os.ReadFile(opts.HTTPClientTLSRootCAFile)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to read TLS root CA file %s - %s\",\n\t\t\t\topts.HTTPClientTLSRootCAFile, err)\n\t\t}\n\t\tif !tlsCertPool.AppendCertsFromPEM(caCertFile) {\n\t\t\treturn nil, fmt.Errorf(\"failed to AppendCertsFromPEM %s\", opts.HTTPClientTLSRootCAFile)\n\t\t}\n\t\tn.httpClientTLSConfig.RootCAs = tlsCertPool\n\t}\n\n\tfor _, address := range opts.NSQLookupdHTTPAddresses {\n\t\t_, err := net.ResolveTCPAddr(\"tcp\", address)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to resolve --lookupd-http-address (%s) - %s\", address, err)\n\t\t}\n\t}\n\n\tfor _, address := range opts.NSQDHTTPAddresses {\n\t\t_, err := net.ResolveTCPAddr(\"tcp\", address)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to resolve --nsqd-http-address (%s) - %s\", address, err)\n\t\t}\n\t}\n","sourceCodeStart":61,"sourceCodeEnd":97,"githubUrl":"https://github.com/nsqio/nsq/blob/85cf10c09c6c3c86160d6f0eb156f62d0efc1648/nsqadmin/nsqadmin.go#L61-L97","documentation":"After successfully reading --http-client-tls-root-ca-file, nsqadmin seeds an x509.CertPool for its HTTPS client; if AppendCertsFromPEM returns false — the bytes were read but contain no parseable CERTIFICATE PEM block — startup fails with 'failed to AppendCertsFromPEM %s' naming the file. This is the parse-stage sibling of the read error: the file exists and is readable, but is not usable as PEM certificates.","triggerScenarios":"The CA file is DER-encoded, is actually a key/CSR, has corrupted BEGIN/END armor or Base64, or is empty (empty files read fine and then fail here). Concatenated bundles are fine as long as every block is a valid CERTIFICATE.","commonSituations":"Internal PKI exports .crt as DER by convention while Go needs PEM; secrets rendered with template markers left in; file truncated by a size-limited config key; someone pointed the flag at the TLS key by accident.","solutions":["Verify PEM parseability: 'openssl x509 -in <file> -noout -subject' (add -inform der and convert if it is DER: 'openssl x509 -inform der -in ca.der -out ca.pem').","Inspect the file: 'grep -c \"BEGIN CERTIFICATE\" <file>' must be >= 1; look for stray whitespace/markers around the armor lines.","Regenerate or re-copy the CA file from the source of truth and restart nsqadmin."],"exampleFix":"# before\nnsqadmin --http-client-tls-root-ca-file=/etc/nsq/ca.der\n# failed to AppendCertsFromPEM /etc/nsq/ca.der\n\n# after\nopenssl x509 -inform der -in /etc/nsq/ca.der -out /etc/nsq/ca.pem\nnsqadmin --http-client-tls-root-ca-file=/etc/nsq/ca.pem","handlingStrategy":"validation","validationCode":"// pre-start: parse check mirroring nsqadmin's pool build\nb, err := os.ReadFile(path)\nif err != nil {\n    return err\n}\nif !x509.NewCertPool().AppendCertsFromPEM(b) {\n    return fmt.Errorf(\"%s contains no PEM certificates\", path)\n}","typeGuard":null,"tryCatchPattern":"if err := startNsqadmin(cfg); err != nil {\n    if strings.Contains(err.Error(), \"failed to AppendCertsFromPEM\") {\n        return errors.New(\"root CA file is not PEM; convert DER with: openssl x509 -inform der -in f -out f.pem\")\n    }\n    return err\n}","preventionTips":["Standardize on .pem extensions for all Go-facing TLS material.","CI-validate CA bundles with AppendCertsFromPEM before shipping.","Never let templates or humans hand-edit PEM armor."],"tags":["tls","x509","pem","nsqadmin","configuration","startup"],"backgroundTag":null,"analyzedSha":"85cf10c09c6c3c86160d6f0eb156f62d0efc1648","analyzedAt":"2026-08-16T00:53:05.009Z","schemaVersion":2},"datasetVersion":"2026-08-16T03:17:38.424Z"}